EncryptionFormat uses ConstantsTrait
On-disk file format constants for {@see \oihana\files\openssl\OpenSSLFileEncryption}.
The V2 format is the authenticated, KDF-protected format produced by encrypt().
Files without the magic header are decrypted as legacy V1 (CBC + raw passphrase as key).
Layout of a V2 file:
┌─────────┬─────────┬─────────┬──────────┬──────────┬──────────────────────┐
│ MAGIC │ VERSION │ KDF │ SALT │ IV │ ciphertext + TAG │
│ 4 bytes │ 1 byte │ 1 byte │ 16 bytes │ 12 bytes │ variable + 16 bytes │
└─────────┴─────────┴─────────┴──────────┴──────────┴──────────────────────┘
The KDF byte indicates how the encryption key was derived from the passphrase. Storing it in the file lets a different environment decrypt the file — the receiver does not need the same KDF implementation available, only the one that was used at encryption time.
Tags
Table of Contents
Constants
- DEFAULT_CIPHER : string = 'aes-256-gcm'
- Default AEAD cipher used when writing V2 files.
- GCM_IV_LENGTH : int = 12
- AES-GCM IV length in bytes (12 = 96 bits, NIST SP 800-38D recommendation).
- GCM_TAG_LENGTH : int = 16
- AES-GCM authentication tag length in bytes (16 = 128 bits, maximum security).
- HEADER_LENGTH : int = 6
- Total length of the V2 format prefix (MAGIC + VERSION + KDF) in bytes.
- KDF_ARGON2ID : int = 1
- KDF identifier: Argon2id (memory-hard, GPU-resistant).
- KDF_LENGTH : int = 1
- Length of the KDF-identifier byte (right after the version).
- KDF_PBKDF2_SHA256 : int = 2
- KDF identifier: PBKDF2-SHA256.
- KEY_LENGTH : int = 32
- Derived symmetric key length in bytes (32 = 256 bits, fits AES-256).
- LEGACY_CIPHER : string = 'aes-256-cbc'
- Default cipher used when reading legacy V1 files (no magic header).
- MAGIC : string = 'OPHE'
- 4-byte ASCII magic identifying an Oihana PHP Encryption file.
- MAGIC_LENGTH : int = 4
- Length of {@see EncryptionFormat::MAGIC} in bytes.
- PBKDF2_ITERATIONS : int = 600000
- PBKDF2 iteration count.
- SALT_LENGTH : int = 16
- KDF salt length in bytes (16 = 128 bits, NIST recommendation).
- VERSION_LENGTH : int = 1
- Length of the version byte.
- VERSION_V2 : int = 2
- Current on-disk format version, written right after the magic.
Constants
DEFAULT_CIPHER
Default AEAD cipher used when writing V2 files.
public
string
DEFAULT_CIPHER
= 'aes-256-gcm'
AES-256-GCM is the modern standard: confidentiality + integrity in a single primitive.
GCM_IV_LENGTH
AES-GCM IV length in bytes (12 = 96 bits, NIST SP 800-38D recommendation).
public
int
GCM_IV_LENGTH
= 12
GCM_TAG_LENGTH
AES-GCM authentication tag length in bytes (16 = 128 bits, maximum security).
public
int
GCM_TAG_LENGTH
= 16
HEADER_LENGTH
Total length of the V2 format prefix (MAGIC + VERSION + KDF) in bytes.
public
int
HEADER_LENGTH
= 6
KDF_ARGON2ID
KDF identifier: Argon2id (memory-hard, GPU-resistant).
public
int
KDF_ARGON2ID
= 1
Requires ext-sodium at both encrypt and decrypt time.
KDF_LENGTH
Length of the KDF-identifier byte (right after the version).
public
int
KDF_LENGTH
= 1
KDF_PBKDF2_SHA256
KDF identifier: PBKDF2-SHA256.
public
int
KDF_PBKDF2_SHA256
= 2
Always available (native PHP).
KEY_LENGTH
Derived symmetric key length in bytes (32 = 256 bits, fits AES-256).
public
int
KEY_LENGTH
= 32
LEGACY_CIPHER
Default cipher used when reading legacy V1 files (no magic header).
public
string
LEGACY_CIPHER
= 'aes-256-cbc'
Matches the historical OpenSSLFileEncryption constructor default.
MAGIC
4-byte ASCII magic identifying an Oihana PHP Encryption file.
public
string
MAGIC
= 'OPHE'
MAGIC_LENGTH
Length of {@see EncryptionFormat::MAGIC} in bytes.
public
int
MAGIC_LENGTH
= 4
PBKDF2_ITERATIONS
PBKDF2 iteration count.
public
int
PBKDF2_ITERATIONS
= 600000
600 000 iterations of SHA-256 ≈ 250 ms on modern hardware. Matches OWASP 2023+ recommendation.
SALT_LENGTH
KDF salt length in bytes (16 = 128 bits, NIST recommendation).
public
int
SALT_LENGTH
= 16
VERSION_LENGTH
Length of the version byte.
public
int
VERSION_LENGTH
= 1
VERSION_V2
Current on-disk format version, written right after the magic.
public
int
VERSION_V2
= 2